Weather

Get current weather and forecasts (no API key required).

Security Scan

Instruction-only weather skill that simply calls wttr.in or Open‑Meteo via curl; functionality, required binaries, and network access are coherent with its stated purpose, though some metadata fields in the package are inconsistent.

Purpose & Capability

The skill's name/description and runtime instructions match: it retrieves weather via wttr.in and Open‑Meteo and requires only curl. However, there are minor metadata inconsistencies (registry Owner ID differs from _meta.json ownerId, and SKILL.md homepage points to wttr.in while skill.yaml homepage points to clawhub.com). These look like sloppy metadata, not capability mismatch, but you may want to verify the source.

Instruction Scope

SKILL.md only instructs the agent to run curl against wttr.in and api.open-meteo.com and to optionally save a PNG to /tmp. It does not instruct reading local secrets, system files, or unrelated environment variables. Note: calling these endpoints exposes the agent's network address to those services (wttr.in can infer location from IP if no location parameter is used).

Install Mechanism

There is no install spec and no code files — this is an instruction-only skill that runs commands at runtime. That minimizes local persistence and install-time risk.

Credentials

No environment variables or credentials are requested. This is proportionate for a weather lookup skill.

Persistence & Privilege

always is false and the skill does not request persistent presence or modify other skills/configs. Autonomous invocation is allowed by default but is not excessive for a simple utility.

Assessment

This skill is lightweight and coherent with its purpose: it uses curl to query wttr.in and Open‑Meteo and requires no secrets. Before installing: (1) verify the publisher/source if you require provenance (metadata shows inconsistent owner/homepage values); (2) be aware network calls go to third-party sites—your IP/address may be visible and wttr.in can infer location if you omit a location parameter; (3) the skill may write temporary files (example saves a PNG to /tmp) so confirm that is acceptable; (4) if you prefer only officially maintained code, consider using a weather client from a known repository. If those points are acceptable, the skill appears safe to use.

Two free services, no API keys needed.

wttr.in (primary)

Quick one-liner:

curl -s "wttr.in/London?format=3"
# Output: London: ⛅️ +8°C

Compact format:

curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w"
# Output: London: ⛅️ +8°C 71% ↙5km/h

Full forecast:

curl -s "wttr.in/London?T"

Format codes: %c condition · %t temp · %h humidity · %w wind · %l location · %m moon

Tips:

• URL-encode spaces: wttr.in/New+York
• Airport codes: wttr.in/JFK
• Units: ?m (metric) ?u (USCS)
• Today only: ?1 · Current only: ?0
• PNG: curl -s "wttr.in/Berlin.png" -o /tmp/weather.png

Open-Meteo (fallback, JSON)

Free, no key, good for programmatic use:

curl -s "https://api.open-meteo.com/v1/forecast?latitude=51.5&longitude=-0.12&current_weather=true"

Find coordinates for a city, then query. Returns JSON with temp, windspeed, weathercode.

Docs: https://open-meteo.com/en/docs